{"id":"GHSA-w4fh-qvv9-3v23","summary":"Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server","details":"### Summary\nIn affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.\n\n### Am I affected?\nYes, if your HTTP server uses the SDK's bearer authentication (`auth=AuthSettings(...)` with `token_verifier=`), its authorization server also issues tokens for other services, and your `TokenVerifier` does not check the token's audience (`aud`) itself.\n\nAffected versions:\n\n- `mcp` 1.10.0 through 1.29.1\n- `mcp` 2.0.0 through 2.1.1\n\n### Fix\nUpgrade to:\n\n- 1.x: `mcp` 1.30.0 or later\n- 2.x: `mcp` 2.2.0 or later\n\n**Upgrading alone changes nothing.** The patched versions add a `validate_token_resource` setting that is off unless you set it. To turn the check on, make both of these changes together:\n\n1. Set `validate_token_resource=True` in `AuthSettings`, with `resource_server_url` set to the audience your authorization server puts in tokens for your server.\n2. Return the token's audience from `verify_token()` as `AccessToken.resource`.\n\nA token for another service then gets `401`. With only the first change, every request gets `401`.\n\nIf your `TokenVerifier` already checks the audience, set `validate_token_resource=False` to silence the deprecation warning. The setting will default to `True` in 3.0.\n\nIf you cannot upgrade yet, reject any token whose `aud` does not include your server inside `verify_token()`. That closes the issue on every version.","aliases":["CVE-2026-116684"],"modified":"2026-10-27T21:15:03.825987077Z","published":"2026-10-27T21:06:59Z","database_specific":{"cwe_ids":["CWE-863"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-10-27T21:06:59Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3447"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3451"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512"},{"type":"PACKAGE","url":"https://github.com/modelcontextprotocol/python-sdk"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"}],"affected":[{"package":{"name":"mcp","ecosystem":"PyPI","purl":"pkg:pypi/mcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}]}],"versions":["2.0.0","2.0.1","2.1.0","2.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-w4fh-qvv9-3v23/GHSA-w4fh-qvv9-3v23.json"}},{"package":{"name":"mcp","ecosystem":"PyPI","purl":"pkg:pypi/mcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.30.0"}]}],"versions":["1.10.0","1.10.1","1.11.0","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.13.0","1.13.1","1.14.0","1.14.1","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.20.0","1.21.0","1.21.1","1.21.2","1.22.0","1.23.0","1.23.1","1.23.2","1.23.3","1.24.0","1.25.0","1.26.0","1.27.0","1.27.1","1.27.2","1.28.0","1.28.1","1.29.0","1.29.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-w4fh-qvv9-3v23/GHSA-w4fh-qvv9-3v23.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}